Google Drive Skill

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:24 PM UTC
• Version:
  0.1.0

Overview

This is a straightforward Google Drive helper, but it can change, delete, and share Drive files if you give it write credentials.

Install only if you want an agent to perform Google Drive CRUD actions. Use a dedicated service account with access only to intended folders, keep its JSON key outside repos, verify SKILL_SCRIPTS before execution, and require explicit confirmation before using --public, --make-public, writer sharing, or permanent deletion.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README includes commands to make files public or share them with other users, but it does not place an explicit warning next to those examples about exposing data externally. In a skill centered on Drive CRUD and permissions, this increases the chance of accidental over-sharing by users copying commands verbatim, especially for sensitive files.

VirusTotal

66/66 vendors flagged this skill as clean.